[Web4lib] Windows Steady State (Bill Coffey)

Thu Jul 16 12:47:44 EDT 2009

I've had quite a few requests to go over how I use Steady State, what are
some of the settings I've implemented, and the annoyances I've encountered,
so I'm actually going through the process on a new machine while I type
this. I'll outline some of the major events in the process. 

A few things to keep in mind... Steady State works just fine off a flash
drive. Also, the library I am in is not on a domain (yet). Group policies
are not an option for me. We are currently in workgroups.

In starting the installation, whether it's a new machine or using an old
one, I'd clean it off pretty well. Get everything off there that you don't
need. To go along with this, any programs that you DO want your patrons to
use, make sure you have them installed. Get the desktop looking the way you
want. If you want IE to say "Card Catalog", change it beforehand. Also, get
your programs working the way you want too. It's much easier to do all of
this before you install Steady State than after. (Found that out the hard
way.)

Once you install Steady State, everything tends to flow like a normal
Microsoft product setup process; point and click, choose the settings you
want. In my case, for the card catalogs and print kiosks, I lock pretty much
everything down. With Steady State, you have the option of creating new user
accounts like normal, but instead of just choosing if the account is limited
or administrator, you are able to select varying degrees of how limited or
free the account can be. It is for this simple fact that I'm really happy
with the product. "Limited" was still too liberal for my needs on our card
catalogs and kiosks. When it comes to setting up various restrictions and
rights, there a few global restrictions available that will affect all
accounts, but you have the option to change rights on a user-account basis
only. In the latter case, any setup options you choose will only affect the
user account you have selected/created.

Some of the global computer restrictions available with Steady State are
preventing users from writing to USB drives or the hard drives, prevent the
storing of passwords, and preventing locked or roaming profiles. You even
have the option of removing the "Shut Down" and "Turn Off" options from the
log on screen. There are also hard disk protection options that allow you to
remove all changes made each time a computer is restarted, to retain changes
only temporarily, or to retain them permanently. In my opinion, the removing
changes at restart option would be ideal for public access computers. For
the card catalogs and kiosks, I chose to retain changes permanently, which
I'll explain in a moment.

For user-account basis only, there are 4 sub menus: 

- General (allows you to lock profiles, set session timers, passwords, and
delete accounts)
- Windows Restrictions (everything Windows related)
- Feature Restrictions (everything related to Internet Explorer and
Microsoft Office)
- Block Programs (allows you to select individual programs to allow or deny
use)

These are a few of the restrictions I use (I won't list everything, just
some of the main ones):

- Lock the profile to prevent users from making any changes

- Block access to all programs except for IE for the card catalogs, and the
print management/reservation system software for the kiosks.

- IE restrictions include preventing internet access to all sites but our
catalog. For this, you check a box in Feature Restrictions called "prevent
Internet access (except Web sites below)". In the same window, further down,
you can manually specify the home page, and any web addresses you wish to
allow. This isn't a solution for public access computers. It will really
only work for computers that you want to allow access to a limited number of
websites. I also prevent registry changes to IE and disable favorites
access. I remove all menu and toolbar options.

- Windows restrictions include preventing right click in the Start Menu,
removing all icons other than IE, I do keep the shut down button so that
staff can shut down the machine at night. You can remove it so that log off
is the only option, and then staff can shut down from the logon screen
(provided you did not disable that function in the above mentioned global
computer restrictions) or logon as staff and then shut down, but I chose to
save them a step. If a patron shuts it down, the staff member can just
restart the machine. You can prevent access to regedit, command prompt, and
even the taskbar and task manager. You can hide the various drives from
users as well. There are many options to choose from; they get rather
granular, which is nice.

As for why I chose to retain changes permanently for the hard disk, I
discovered that to keep the annoying IE popups from reappearing every day, I
needed to either choose to retain changes permanently, or turn off disk
protection entirely. For our catalog, there are several popups that would
appear each time IE starts from a fresh reboot, like the "do you want to
turn on automatic phishing filter", then the bubble at the bottom that says
the site is being reviewed for phishing (or to check it for phishing), auto
complete, and the "when you send information to the Internet, it might be
possible...". By choosing to retain changes permanently, once I make my
selections for each of those popups, they no longer appear each time the
machine is rebooted. Since I have basically allows patrons to only access
IE, and to only get to our catalog's web address, wiping out changes made
after rebooting isn't necessary - they can't make any changes beyond the
popups. If I use Steady State for public access computers, patrons would
have greater access to the machines and could therefore make changes that
would need to be wiped out.

We do use Deep Freeze on our Public Access Computers and for now, I'll
probably keep it that way since we already have the licenses. I haven't been
with my library but a few months, so I'm trying to be gradual in introducing
change; small steps seem to be accepted much more easily here. Considering
how Steady State has worked, I would eventually like to go that direction
for all our machines. 

I hope this helps - I know it has been a rather lengthy email and I've tried
to answer all the questions I received off-line. I will also send this over
to techsoupforlibraries as mentioned by another listserv follower. If you
have any further questions, I would be happy to answer them!

Thanks,

Kelly Fann, MLS
Technology Coordinator/Systems Administrator
kfann at leavenworth.lib.ks.us

Leavenworth Public Library
417 Spruce Street
Leavenworth, KS 66048
913-682-5666 x213
www.leavenworthpubliclibrary.org

-----Original Message-----
From: Gerry O. Laroza [mailto:glaroza at ateneo.edu] 
Sent: Wednesday, July 15, 2009 5:53 PM
To: Kelly Fann
Cc: web4lib at webjunction.org
Subject: Re: [Web4lib] RE: Windows Steady State (Bill Coffey)

We are also using Steady State as an alternative to DeepFreeze in our  
Internet labs, and we are happy with it. I haven't explore yet all the  
features of the program, but I am more happy if Kelly can discuss more  
on how to make the program limit the IE to access certain website only.

Thanks

Gerry O. Laroza
Computer & Audio-visual Section
Rizal Library
Ateneo de Manila University
Philippines

"Hardwork is useless, unless appreciated!"

Quoting Kelly Fann <kfann at leavenworth.lib.ks.us>:

> Bill,
>
> I am currently using Steady State for our card catalog computers. So far,
> I've been relatively pleased with it. It seems to be a consolidated
version
> of a various XP registry "hacks" that I would usually implement to turn
> computers into kiosk mode. There have been a lot of books published in the
> past discussing the hacks in great detail. It appears that Microsoft
finally
> got on the ball and created a program to make it a bit more
point-and-click.
> There's still a few minor bug issues, which I'd be happy to discuss with
you
> offline if you'd like. They're more annoyances than anything else and I
have
> found workarounds for them. For the most part, I'm pretty happy with it.
> Honestly, the main feature I appreciate is how extremely easy it was to
make
> the only desktop icon patrons can see and use is IE, and the only website
> they can access from IE is our card catalog. Nothing else is available to
> them beyond the log off function from the start menu. Hope that helps!
>
>
> Kelly Fann, MLS
> Technology Coordinator/Systems Administrator
> kfann at leavenworth.lib.ks.us
>
> Leavenworth Public Library
> 417 Spruce Street
> Leavenworth, KS 66048
> 913-682-5666 x213
> www.leavenworthpubliclibrary.org
>
>
>
> -----Original Message-----
>
> Message: 4
> Date: Wed, 15 Jul 2009 09:58:58 -0400
> From: "Bill Coffey" <bill.coffey at waynegov.com>
> Subject: [Web4lib] Windows Steady State
> To: <web4lib at webjunction.org>
> Message-ID:
>
> <19DEA96AE062D043A40CEA1D8A31727B04FDE6FD at MSDTC-RESOURCE.waynegov.local>
>
> Content-Type: text/plain;	charset="US-ASCII"
>
> Sorry for any duplicate entries.
>
> Does anyone use Windows Steady State?
>
> Have you had any problems?
>
> How do you like it?
>
> Thanks in advance.
>
>
>
> Bill Coffey
>
> Wayne County Public Library
>
>
>
>
>
>
>
> _______________________________________________
> Web4lib mailing list
> Web4lib at webjunction.org
> http://lists.webjunction.org/web4lib/
>
>